Technical due diligence
Find out what you're actually buying, before you sign
The pitch says the platform is scalable, the code is clean and the team is strong. Sometimes it is. Technical due diligence is a senior engineer reading the code, the infrastructure, the security posture and the running costs, and telling you in plain language what's true, what it will cost to fix, and what you should ask before the money moves.
Every layer of the stack read in turn, and the findings rated so a board can see the two things that matter without reading the forty that don't.
In short
PixelApps carries out technical due diligence for Australian investors, acquirers and boards: a senior engineer reviews the code, architecture, infrastructure, security, running costs and team of a software business or product, and delivers a written report with risk ratings, remediation cost estimates and the questions to ask. Fixed price, agreed before we start, usually inside two weeks of access.
This is for you if
- Investors and angels putting money into a software business and wanting a technical view they can defend
- Acquirers buying a business whose value sits in a platform, a codebase or a data asset
- Boards and directors who need an independent read on the technology they're responsible for
- Business owners about to commit to a large build, a platform migration or a long vendor contract
- Founders preparing for a raise who want to find the problems before the investor's engineer does
It isn't if
- The owner of an app that's broken or stalled. That's a rescue audit, it costs $495, and it's on the fix pages.
- A large engineering organisation with hundreds of services. You want a specialist due diligence firm with a team, and we'll say so.
- A deal that needs a rubber stamp. If the report has to say the right thing, we're the wrong firm.
What you get
A summary a board can read in five minutes
The verdict, the two or three findings that affect the deal, and what they'd cost to put right. Written for the people deciding, not for the engineers.
A risk register with severity and cost
Every finding rated by likelihood and impact, with an estimate of the effort to remediate, so problems can be priced into the deal rather than argued about afterwards.
Architecture and scalability, tested against the plan
Whether the system will carry the growth in the business plan, where it breaks first, and what it costs to get past that point. Not a theoretical opinion: read against the actual code and traffic.
Security and data handling
Authentication, access control, secrets, dependencies, backups, and how customer data is stored and shared. The findings that turn into breaches, and the ones that turn into Privacy Act problems.
Ownership, licensing and running costs
Who owns the code, what's under which licence, what the platform costs a month and how that grows. The commercial questions engineers usually skip.
Team and key-person risk
How much lives in one head, how work gets shipped, and whether the team you're buying is the team that built it. Plus the questions to ask them, and what a good answer sounds like.
Three ways to engage
The cadence is agreed up front and can change with a month's notice. The fee is fixed in writing on the first call.
Pre-investment
One to two weeks from access
For angels, funds and family offices. A technical view sized to the cheque, from a half-day read for a small round to a full review for a lead position.
Acquisition
Two to three weeks from access
For buyers of a business whose value is in its platform. Deeper on ownership, licensing, data, running costs and what it takes to keep the thing running after the founders leave.
Pre-commitment review
About a week
For an owner about to sign a large build, a migration or a long vendor contract. The proposal, the architecture and the quote read by someone with no stake in the answer.
The first ninety days
- 01
The first call
What the deal is, what's being claimed, what you're worried about and when you need the answer. We scope the review to the decision and give you a fixed price.
- 02
NDA and access
A mutual NDA, then read access to repositories, infrastructure, documentation and, where useful, an hour with the technical lead. We work on copies and change nothing.
- 03
The review
A senior engineer reads the code, the architecture and the accounts, runs the checks, and tests the claims in the deck against what's actually there. Usually one to two weeks.
- 04
The report, and a call with the deal team
A written report, a walk-through with whoever is deciding, and answers to the follow-up questions. If you want the findings fixed, the report says what that costs and you can take it anywhere.
Due diligence, the rescue audit, or a fractional CTO
Three reviews we offer, for three different questions. The right one depends on who's asking and what they're about to do.
| Criteria | Technical due diligence | Rescue audit | Fractional CTO |
|---|---|---|---|
| Who it's for | Someone about to put money behind software | The owner of an app that's broken or stalled | A company that needs ongoing technical leadership |
| The question | Is it what they say it is, and what will it cost me? | What's wrong, and what will it take to fix? | What should we do next, and who should do it? |
| What you get | A board-ready report with risk ratings and remediation costs | A written report on code, database and hosting | A standing engagement, a roadmap, decisions made |
| Time | One to three weeks | 3 business days | Ongoing, month to month |
| Price | Fixed, quoted on the first call | $495 fixed | Fixed monthly fee |
Work we can show
The public ones. Most engagements sit under client agreements and can be walked through on a call.
Hawker Spaces
Pop-up retail platform — Melbourne & Sydney
A multi-location platform with live availability, enquiries and bookings for short-term retail spaces.
Brands find and book premium retail spaces across Melbourne and Sydney, all in one place.
Theodore Men's Jewellery
Men's jewellery e-commerce — South Yarra, Melbourne
A rework and polish of the existing store — sharper product presentation, technical SEO throughout, and the full catalogue live on Google Shopping.
Since taking over in late 2025: online sales up 84%, orders up 53% and Google profile views up 45% year on year.
When we're not the answer
If the deal is small and the product is a marketing website, an afternoon with the questions in our buying guide will do and we'd be overkill. If the target runs hundreds of services with a large engineering team, you want a specialist firm with a team of reviewers, not a studio. And we won't do the review and then pitch to rebuild what we found: the report says what remediation costs, and you can take it to anyone.
Start with a conversation
An hour on where you are and what's in front of you. You'll leave with a straight answer on whether this is the right shape, and the monthly figure if it is.
Common questions
Code quality and maintainability, architecture and scalability against the business plan, security and data handling, infrastructure and its monthly cost, ownership and licensing of everything in the codebase, and the team: how work ships and how much depends on one person. Each area gets findings, a severity and a remediation estimate.
Usually one to two weeks from getting access, up to three for an acquisition. The price is fixed and sized to the decision: a small round needs less than a lead position or a purchase. We quote on the first call, in writing, before starting.
Read access to the repositories, the hosting and infrastructure accounts, any documentation, and ideally an hour with the technical lead. Everything happens under a mutual NDA, we work on read-only copies, and we change nothing.
The rescue audit is for the owner of an app that's broken or stalled and wants to know what it takes to fix. Due diligence is for the person about to put money behind software they don't own yet, and it's written for a deal: risk ratings, remediation costs, and the questions to ask before signing.
If you ask, yes, through the development team or a fractional CTO engagement. But the report is written to stand on its own, with remediation estimates any competent firm can work from, and we'd rather you compared quotes than felt obliged. A review that leads to its own upsell isn't independent.
Yes, and it's increasingly what we're asked to look at. AI-built products have a recognisable set of problems, mostly around security rules, secrets and the parts that were never finished, and we've written about them on the fix pages. The review says which of those apply and what it costs to make the product something you'd want to own.
The kind of thing we build
Working software, running with a fictional business and sample data. Use it, then decide.
Also worth a look
- A fractional CTO for companies that can't yet justify a full-time one
- A senior development team you switch on when you need it
- Who owns the code, the domain and the accounts
- The security holes we find most often
- Inheriting a codebase nobody understands
Last reviewed . Market figures are indicative Australian ranges, not our prices. Our fee is fixed in writing on the first call.